# Trouble using in-client OAuth silently (\`authorize\` API) **URL:** \ **Category:** Zoom Apps\ **Created:** [October 19, 2022, 7:37pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634 "2022-10-19T19:37:07Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![om7](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/om7/32/36428_2.png) [@om7](https://devforum.zoom.us/u/om7)\ **Post date:** [October 19, 2022, 7:37pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/1 "2022-10-19T19:37:07Z")
Hey all, I am writing this post to seek guidance on how to implement in-client OAuth - I am experiencing an issue related to the `authorize()` API. When using my development app with the relevant features and scopes enabled, and having installed the app, n the “Allow” splash screen always shows when invoking the `authorize()` API. [Here is a Loom video demonstrating the issue](https://www.loom.com/share/6100d70005c443049e5802e62c3d5762) A few specific questions: 1. How can we use the `authorize` API silently? (without triggering the “Allow” splash screen) When I load my app, my user context has status `'authorized'`, but the splash screen still shows when triggering `authorize()`. Is this a bug? Or, is this something that behaves differently in development apps? I can’t seem to get the `onAuthorized` event to be sent, because the splash screen always shows on my development app when I trigger the `authorize` API, despite being in `state: 'authorized'` 1. When a user installs the app from within the client, what is the ideal flow for using `authorize` and `onAuthorized`? I modelled off the [Advanced React Sample App](https://github.com/zoom/zoomapps-advancedsample-react), but still finding it very confusing. After a user has clicked “Add” and then “Allow” from the Marketplace in the client, the app will load. Should we then do the following? 1. (User clicks “Allow” in the Zoom client to install our app) 2. Our app begins to load 3. Our app notices we do not have a user stored yet for this user ID, so; 4. Our app invokes the `authorize` API 5. Our app waits for an `onAuthorized` event 6. We receive the event, submit the `code` to our server and handle retrieving an access & refresh token 7. Our server the uses this new access token to retrieve the user and other relevant data from the Zoom REST API 8. Our server returns this data and the access token to our Zoom app 9. Our app finishes loading Any guidance would be much appreciated ---
**Author:** ![john.ordonez](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/john.ordonez/32/42402_2.png) [@john.ordonez](https://devforum.zoom.us/u/john.ordonez)\ **Post date:** [October 20, 2022, 2:48pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/2 "2022-10-20T14:48:29Z")
We’re facing something similar. After showing the authorize prompt and the user accepting it, we then call the authorize API, again it shows the “Allow screen”, the authorize endpoint responds successfully and when calling zoomSdk.authorize the app just dies and restarts and keeps showing the “Allow screen” everytime we try to authorize and proceeds to restart itself(browser inspector closes and the panel goes to blank, opens the app again). ---
**Author:** ![om7](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/om7/32/36428_2.png) [@om7](https://devforum.zoom.us/u/om7)\ **Post date:** [October 20, 2022, 6:33pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/3 "2022-10-20T18:33:11Z")
Update: Refined my post and updated the video. ---
**Author:** ![ash.provost](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ash.provost/32/36610_2.png) [@ash.provost](https://devforum.zoom.us/u/ash.provost)\ **Post date:** [October 25, 2022, 3:50pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/4 "2022-10-25T15:50:44Z")
If you’ve already authorized your app, you can refresh your token via: `/oauth/token` endpoint ([OAuth with Zoom](https://marketplace.zoom.us/docs/guides/auth/oauth/#refreshing-an-access-token)) You can store the access token on the backend against the zoom user id, so they can retrieve it when the user visits, via the zoom user id in the x-zoom-app-context ---
**Author:** ![om7](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/om7/32/36428_2.png) [@om7](https://devforum.zoom.us/u/om7)\ **Post date:** [October 25, 2022, 5:41pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/5 "2022-10-25T17:41:37Z")
Thanks @ash.provost , we do that today for existing users that authorize from the web. I’m currently trying to figure out how to do the same for new users installing from the client The problem I’m encountering at the moment is that when a user installs in the client (so, they’ve now authorized our app), the app loads and we don’t yet have an access or refresh token. We notice this, and so invoke `authorize()`, but it shows the “Allow” screen. I expected it to be a non-interactive OAuth flow, completely invisible to the user as outlined [here](https://marketplace.zoom.us/docs/zoom-apps/guides/authentication/#2-use-the-authorize-method-and-onauthorized-event-in-your-app) Would you be able to help by breaking down the steps for authorizing the in the client? Specifically, when should we call the `authorize()` API? ---
**Author:** ![om7](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/om7/32/36428_2.png) [@om7](https://devforum.zoom.us/u/om7)\ **Post date:** [October 28, 2022, 4:27pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/6 "2022-10-28T16:27:24Z")
Hey @ash.provost , just wanted to follow up on this – any ideas why calling `authorize()` does not start a non-interactive OAuth flow in my development app? ---
**Author:** ![ash.provost](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ash.provost/32/36610_2.png) [@ash.provost](https://devforum.zoom.us/u/ash.provost)\ **Post date:** [October 28, 2022, 8:15pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/7 "2022-10-28T20:15:47Z")
We will raise this to our team to see if its a bug ---
**Author:** ![om7](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/om7/32/36428_2.png) [@om7](https://devforum.zoom.us/u/om7)\ **Post date:** [November 16, 2022, 7:39pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/8 "2022-11-16T19:39:47Z")
The bug was on our end; When calling POST [https://zoom.us/oauth/token](https://zoom.us/oauth/token) (from [the docs here](https://marketplace.zoom.us/docs/guides/auth/oauth/#step-2-request-access-token)) We were using the wrong `redirect_uri` value in the request body. We are now using our front-end web application’s URL when doing in-client OAuth, instead of redirecting to our back-end auth URL (as we do when a user installs from the browser). ---
**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\ **Post date:** [November 16, 2022, 10:14pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/9 "2022-11-16T22:14:26Z")
Thank you for keeping us posted! ---
**Author:** ![tkishkin](https://avatars.discourse-cdn.com/v4/letter/t/57b2e6/32.png) [@tkishkin](https://devforum.zoom.us/u/tkishkin)\ **Post date:** [January 21, 2025, 1:03pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/10 "2025-01-21T13:03:18Z")
Hi! I know it’s an old topic, but I have the same problem and the solution doesn’t work for me. After my app is added via in-client auth, I detect that there are no saved tokens yet and make `authorize` call, which **shows the consent screen again,** even though the user context state is `authorized`. Which is a nuisance for the user. At this point I haven’t called `https://zoom.us/oauth/token` yet (as I don’t have auth code yet), so I don’t understand how wrong `redirect_uri` could matter. Maybe someone could clarify? CC @om7, @ash.provost ---
**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\ **Post date:** [February 12, 2025, 4:59pm UTC](https://devforum.zoom.us/t/trouble-using-in-client-oauth-silently-authorize-api/77634/11 "2025-02-12T16:59:58Z")
> [@tkishkin](#): > > Hi! I know it’s an old topic, but I have the same problem and the solution doesn’t work for me. > > After my app is added via in-client auth, I detect that there are no saved tokens yet and make `authorize` call, which **shows the consent screen again,** even though the user context state is `authorized`. Which is a nuisance for the user. > > At this point I haven’t called `https://zoom.us/oauth/token` yet (as I don’t have auth code yet), so I don’t understand how wrong `redirect_uri` could matter. Maybe someone could clarify? Please see this post for solution for **consent screen again** even though the user context state is `authorized`: > [@In-client OAuth (\`authorize\` API) is not silent](https://devforum.zoom.us/t/in-client-oauth-authorize-api-is-not-silent/125029/8): > > Hi @donte.zoom , as I already mentioned in the community forum, a fix was found thanks to your suggestion. All I had to do was to add under “OAuth Allow Lists” the URL of the page from which the zoomSdk.authorize call was being made. In my case, https://zoom-cross-tenant.staging-linkando.com/zoomapp. Indeed, the [documentation](https://developers.zoom.us/docs/zoom-apps/authentication/#enabling-in-client-oauth-for-your-app) mentiones: "under the OAuth allow list section, add your app’s Home URL". The confusion in my case was due to the fact that my home URL redirects the user further to anot…